On 2021-10-04 12:08, Paul Moore wrote: > On Wed, May 19, 2021 at 4:02 PM Richard Guy Briggs <rgb@xxxxxxxxxx> wrote: > > > > Since the openat2(2) syscall uses a struct open_how pointer to communicate > > its parameters they are not usefully recorded by the audit SYSCALL record's > > four existing arguments. > > > > Add a new audit record type OPENAT2 that reports the parameters in its > > third argument, struct open_how with fields oflag, mode and resolve. > > > > The new record in the context of an event would look like: > > time->Wed Mar 17 16:28:53 2021 > > type=PROCTITLE msg=audit(1616012933.531:184): proctitle=73797363616C6C735F66696C652F6F70656E617432002F746D702F61756469742D7465737473756974652D737641440066696C652D6F70656E617432 > > type=PATH msg=audit(1616012933.531:184): item=1 name="file-openat2" inode=29 dev=00:1f mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 > > type=PATH msg=audit(1616012933.531:184): item=0 name="/root/rgb/git/audit-testsuite/tests" inode=25 dev=00:1f mode=040700 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=PARENT cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 > > type=CWD msg=audit(1616012933.531:184): cwd="/root/rgb/git/audit-testsuite/tests" > > type=OPENAT2 msg=audit(1616012933.531:184): oflag=0100302 mode=0600 resolve=0xa > > type=SYSCALL msg=audit(1616012933.531:184): arch=c000003e syscall=437 success=yes exit=4 a0=3 a1=7ffe315f1c53 a2=7ffe315f1550 a3=18 items=2 ppid=528 pid=540 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=ttyS0 ses=1 comm="openat2" exe="/root/rgb/git/audit-testsuite/tests/syscalls_file/openat2" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="testsuite-1616012933-bjAUcEPO" > > > > Signed-off-by: Richard Guy Briggs <rgb@xxxxxxxxxx> > > Link: https://lore.kernel.org/r/d23fbb89186754487850367224b060e26f9b7181.1621363275.git.rgb@xxxxxxxxxx > > --- > > fs/open.c | 2 ++ > > include/linux/audit.h | 10 ++++++++++ > > include/uapi/linux/audit.h | 1 + > > kernel/audit.h | 2 ++ > > kernel/auditsc.c | 18 +++++++++++++++++- > > 5 files changed, 32 insertions(+), 1 deletion(-) > > ... > > > diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h > > index cd2d8279a5e4..67aea2370c6d 100644 > > --- a/include/uapi/linux/audit.h > > +++ b/include/uapi/linux/audit.h > > @@ -118,6 +118,7 @@ > > #define AUDIT_TIME_ADJNTPVAL 1333 /* NTP value adjustment */ > > #define AUDIT_BPF 1334 /* BPF subsystem */ > > #define AUDIT_EVENT_LISTENER 1335 /* Task joined multicast read socket */ > > +#define AUDIT_OPENAT2 1336 /* Record showing openat2 how args */ > > As a heads-up, I had to change the AUDIT_OPENAT2 value to 1337 as the > 1336 value is already in use by AUDIT_URINGOP. It wasn't caught > during my initial build test as the LSM/audit io_uring patches are in > selinux/next and not audit/next, it wasn't until the kernel-secnext > build was merging everything for its test run that the collision > occurred. I'll be updating the audit/next tree with the new value > shortly. I was expecting a conflict, so thanks for the heads up, Paul. Steve: This affects the audit userspace support for this patchset previously published 2021-05-19 as: https://github.com/rgbriggs/audit-userspace/tree/ghau-openat2 The update is here: https://github.com/rgbriggs/audit-userspace/tree/ghau-openat2.v2 And a PR has been created: https://github.com/linux-audit/audit-userspace/pull/219 > paul moore - RGB -- Richard Guy Briggs <rgb@xxxxxxxxxx> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635
